KR20100053900A - Security dedicated device for securities of communication apparatus - Google Patents

Abstract

PURPOSE: A security dedicated apparatus for processing a communication device security function is provided to check forgery / modulation situation of all transceiving data rapidly by realizing a integrity inspection function of the data through PLC(Power Line Communication) or RF(Radio Frequency) as a hardware inside a security dedicated chip. CONSTITUTION: A main controller receives transmission data of a communication device through an interface(101). The interface interfaces data transceiving with the communication device. The main controller proceeds integrity verification by a data integrity verifier(104), an electronic signature by an electronic signature unit and data encoding by an encoding/decoding unit(103). The main controller outputs the processed data in the communication device.

Description

Security dedicated device for securities of communication apparatus processing function

The present invention relates to a security dedicated device for processing a security function of a communication device based on power communication (PLC), and more particularly, to a security dedicated device for processing a security function of a communication device for overcoming security vulnerability of a PLC chip or an RF chip.

Currently operating power line communication (PLC) -based integrated metering network has no security functions except simple data encryption and decryption, which is exposed to cyber threats, and encryption and decryption is also less secure. By using, only formal encryption and decryption functions are applied. In addition, since the RF communication section has no encryption / decryption function, that is, no security considerations, there is a possibility that an unauthorized device is used to connect to the network or act as a security threat to the PLC-based integrated metering network. As a company that establishes and operates a PLC-based integrated meter reading network, there is no way to efficiently manage and control a large number of communication network resources scattered throughout the country, so there is no way to deal with accidents or abuse by others. In particular, forgery and forgery of meter reading information related to billing can cause huge financial loss, which is an urgent need for enhanced security.

Currently, high speed PLC chip (XPLC23), which is applied to KEPCO integrated (remote) meter reading business, uses 56-bit DES for data encryption, but at present, the security reliability of this method is very low, There is a great need for this situation. In addition, the RF communication section used for water and gas remote meter reading does not have such encryption / decryption function, and an appropriate security system is required.

As a symmetric key algorithm, for example, in DES, AES, SEED, etc., the secret key distribution for sharing and changing the secret key with the other party is also a very important issue. However, currently used PLC chip keeps using the secret key used during initial registration without change, so it is relatively vulnerable to external intrusion. In addition, devices such as integrated meter reading meters connected to this network need to check whether the device is authorized by the administrator through the user / device authentication process from the authentication server when the network is first connected.

Until now, commercially available PLC chip embedded devices do not have this certification process or are proceeding in a very simple form, and there is no RF device. Therefore, there is a risk that unauthorized devices may be connected to the network and used. In order to solve this problem, it is possible to perform a secure device authentication by mounting a certificate-based authentication solution given by the administrator.

These security functions can be implemented in the existing PLC chip or RF chip, but in this case, the size of the chip itself is increased and power consumption is increased. In addition, considering the implementation in software using a CPU inside an existing PLC chip or RF chip, it is difficult to implement the current CPU and internal memory, and a new, more powerful CPU must be introduced and the internal memory must be increased. You may also need to increase the clock speed to run the CPU. This additional cost is difficult to implement because of the increase in chip size and power consumption.

The present invention is to provide a method for implementing a security-related function in a separate security dedicated chip to solve the above problems.

The dedicated chip for security according to the present invention implements all functions for encryption and decryption and authentication in hardware logic so that it is possible to sufficiently execute a security function with only a low specification CPU, thereby enhancing the security of the existing communication chip. To play the role of a processor.

According to the present invention, a security-only device for processing the security function of the power communication (PLC) based communication devices, comprising: an interface for data transmission and reception with the communication device; And a main controller; The main controller includes an encryption / decryption unit, a data integrity verification unit, a communication device authentication unit, a security key manager, an electronic signature unit, and a certificate manager; The main controller receives data to be transmitted by the communication device through the interface to perform integrity verification by the data integrity verification unit, digital signature by the electronic signature unit, and data encryption by the encryption / decryption unit. Output to the communication device via the interface; The demodulated data received by the communication device is received through the interface, decrypted by the encryption / decryption unit, signature verification by the digital signature unit, and data integrity verification by the data integrity verification unit. A security only device for processing a security function of a communication device is provided that operates to output to the communication device via an interface.

According to a preferred embodiment of the invention, the security key management unit operates to generate, distribute, update, and discard the security keys required for the encryption / decryption and integrity verification, and may use a public key management mechanism.

According to a preferred embodiment of the invention, said interface for data communication with a communication device exchanges data by serial communication.

According to a preferred embodiment of the present invention, the security-only device further includes a non-volatile memory and mounts a certificate therein so as to perform authentication of the communication device, and the security policy of the company that owns and manages the communication device. Accordingly, the certificate may be secretly generated and mounted inside the security-only device.

According to a preferred embodiment of the invention, said data comprises integrated meter reading data; The communication device authentication unit may be operable to transmit the digital signature to the data by using its own certificate before transmitting the integrated meter reading data.

According to a preferred embodiment of the invention, an RF chip can be further coupled to the security only device.

According to a preferred embodiment of the invention, there is provided a security-only device as described above; An RF chip, an electricity meter, and an HCU for remote reading of electricity, water, and gas, coupled to the security only device; The security only device performs the role of a main controller of the HCU by linking the RF chip and the PLC chip in the HCU; The security-only device is further provided with a PLC-based integrated meter reading device that processes the data output from the electricity meter and delivers it to the PLC-based communication device.

According to a preferred embodiment of the invention, the security only device may be embedded in the RF communication device of the water and gas meter.

Through the present invention it is possible to enhance the security of the PLC communication section and RF communication section of the existing PLC-based integrated meter reading network. Specifically, it has not only authenticated each communication device through a certificate assigned secretly through the central security control center, but also provided a management point to remotely manage them, and also provided the integrity check function of data transmitted through PLC or RF. By implementing the hardware inside the security-only chip, it is possible to quickly and easily check the forgery and alteration status of all transmission / reception data. This is more efficient and better than the error checking of the existing communication method. In addition, the digital signature function is built in to know who is sending the data transmitted through PLC or RF. In particular, it is possible to confirm the accuracy of meter reading information directly related to billing. Lastly, data encryption / decryption function, which was not considered in the RF communication section, is implemented to ensure data confidentiality so that the data contents cannot be known even by unauthorized devices other than the sender and receiver.

The object of the present invention is to strengthen the security function to overcome the security weakness of the PLC-based integrated metering infrastructure as mentioned above, in particular, in place of a communication chip that is difficult to handle a variety of complex operations required for the security function The purpose is to increase the performance and efficiency of the chip by using a dedicated chip to perform all security-related tasks by using a co-processor, and the existing communication chip to perform a unique communication task.

The present invention proposes a configuration and function of a security-only chip, and a method of linking with a PLC chip or an RF chip, thereby protecting the integrated metering infrastructure from various cyber threats when a PLC-based integrated metering network is constructed in the future. Integrated meter reading devices and network resources can be managed and controlled in remote locations in real time.

The technical problem to be solved through the present invention is a security function, such as device authentication, data integrity, digital signature, security key management and data encryption and decryption function, etc. necessary for enhancing the security of the PLC-based integrated metering network and equipment It is to secure a dedicated security chip that can be dedicated, and in particular, by establishing a plan that can ensure the linkage with a PLC chip or an RF chip so that the communication chip can have the same effect as performing its own security function. Therefore, even if the PLC integrated meter reading network is established, it suggests a way to overcome the security weakness.

In order to achieve the object of the present invention, the present invention relates to a security-only chip configuration and method for overcoming the security vulnerability of the PLC-based integrated metering network. First, all devices communicating with the PLC have a built-in PLC chip. Physically, power line communication should be used, but if the main processor of PLC device wants to transmit the data, it is first handed over to the dedicated chip to safely change the data through data integrity, digital signature, and data encryption The chip receives and sends a signal to the power line. On the contrary, when the PLC device receives the data, the received signal on the power line is first received by the PLC chip, demodulated, and then transmitted to the PLC dedicated security chip to verify data decryption, signature verification, and data integrity. Passing it to the main processor allows for secure transmission and reception. In addition, the RF communication chip for water and gas meter that communicates with the HCU embedded in the electricity meter can be utilized in a security-only chip in the same manner as the PLC chip.

More specific to the present invention will be described in detail below with reference to the accompanying drawings.

1 is a block diagram showing the durable configuration of the security dedicated chip 100 according to the present invention. In the present invention, the internal configuration of the security dedicated chip 100 will be described with reference to FIG. 1. First, there is a CPU 102 which is a main controller for performing all security functions of the security dedicated chip 100, and the power communication ( Encryption / decryption that has a serial communication interface as an external interface 101 for communicating with a PLC chip or an RF chip that can be included in a PLC-based communication device, and performs an encryption / decryption function for RF section communication security without encryption / decryption function. There is an engine 103. In addition, there is a data integrity verification engine 104 to prevent forgery and tampering of various communication data including meter reading information, and a device authentication engine 105 to authenticate the chip itself. In addition, the security dedicated chip 100 includes a memory 106, in which the text-based certificate for chip authentication is stored. In addition, there is a random number generator 107 for generating random numbers required to perform security functions, including security key management. These are all connected via an internal data bus. Note that these components can be implemented by hardware.

In addition, in FIG. 1, the PLL is a phase-locked loop for generating a desired driving clock inside the chip, and the JTAG is for debugging a component block inside the chip as needed. Through the use of the internal CPU to check the hardware operation, it can also be used to develop programming running on the internal CPU. In addition, in FIG. 1, the main controller is a main controller for controlling operations between hardware blocks in a chip, and an internal CPU generally performs most of the role, but a controller implemented in hardware for efficiency of internal operations, and the like. It can also be done in conjunction.

FIG. 2 shows that the security dedicated chip 100 further includes software modules for implementing various functions according to the present invention, which can be implemented in software in addition to the hardware-based security chip configuration of FIG. 1.

2 illustrates a method and a function of the security dedicated chip 100 operating in connection with the communication chip 200, for example, a PLC chip or an RF chip. In FIG. 2, the security dedicated chip 100 has the configuration of FIG. 1, and in FIG. 2, the software functional modules in which the various functions required by the present invention can be implemented in software are shown in blocks. .

In FIG. 2, functions that may be optionally implemented in software include a certificate (device-specific information) 202, an authentication 203, a security key management 204, an electronic signature 205, an integrity check 206, Decryption 207 may include functions. For example, certificate 202 may be embedded in a ROM in FIG. 1. Integrity check 206 may also perform functionality via data integrity verification engine 104 in FIG. 1. In FIG. 2, the authentication 203 may perform a function through the PLC device authentication engine 105 in FIG. 1. In addition, the security key management 204 in FIG. 2 may be implemented in software and stored in the memory 106 of FIG. 1 and managed through the CPU 102. In FIG. 2, the electronic signature 205 may perform a function of signing data to be transmitted with a certificate 202 and adding it to the data, and these functions may process the CPU 103 of FIG. 1.

In the implementation of the security dedicated chip 100 in accordance with the present invention, those skilled in the art are hardware implementation of Figure 1 and software functions implemented on the same security dedicated chip 100 in FIG. It will be appreciated that it may be implemented in software, and some may optionally implement hardware or software. The present invention is not limited to this particular implementation, and therefore everything implemented according to design is included in the present invention.

As shown in FIG. 2, the security dedicated chip 100 according to the present invention is coupled to a PLC chip or an RF chip 200 (hereinafter also referred to as a communication chip), so that the data 208 and the control signal 209 therebetween. And the status display signal 210 through the external interface or the host interface 101 in the security dedicated chip 100.

The communication chip 200 and the security dedicated chip 100 transmit and receive data 208 through, for example, a serial communication interface, and a general security policy is carried out mounted on the security dedicated chip 100, but requires a special security function in the communication chip. In this case, it was possible to control the security dedicated chip 100 through the control signal 209. In addition, the security dedicated chip 100 has a separate status display signal 210 to periodically transmit the status information to the communication chip 200 in performing all the functions related to security.

Next, referring to FIG. 2, the security function of the security-only chip 100 is described. First, the data 208 transferred from the communication chip 200 through the serial communication interface as a function of processing communication data ensures integrity. In order to pass the integrity check function 206, a process of generating a hash value for integrity (when transmitting data) or checking a hash value of received data (when receiving data from an external device and handing it to a communication chip) This can be done. In the case of RF communication, the encryption / decryption process is performed through the encryption / decryption module 207 implemented in hardware in the security-only chip 100, for example, according to a preferred embodiment of the present invention. The digital signature 205 is a function for proving that the data is sent from an authorized chip (device). The counterpart's communication device also uses the digital signature function of the internal security chip to confirm that the sender of the transmitted data is an authorized communication device. Done.

The second security function of the security-only chip relates to the authentication of the device (chip), and semi-permanently embeds the text-based certificate 202 in the non-volatile memory embedded in the security-only chip 100, thereby allowing each device (chip) ) Authentication method. The certificate is made by an administrator having authority in the security control center.After the security dedicated chip 100 is produced, the administrator generates a certificate based on a method defined according to the security control policy and embeds the certificate in the security dedicated chip 100. Adopt a method that ensures maximum security for authentication by handing over to the manufacturer of the communications device.

The third security function of the security dedicated chip 100 is a security key management function 204 for securely generating, distributing, updating, and discarding the security key required for the encryption / decryption and integrity check function. In this case, there is a security weakness in the process of generating the security key, but it is difficult to obtain the security expected through encryption and decryption by continuously distributing the generated security key in plain text and using it without updating. The public key management mechanism was introduced as a management method to minimize security vulnerabilities through all the processes, and the chip performance and operation speed were maximized by implementing hardware logic to minimize the load caused by complex computational processes.

Next, another function of the security dedicated chip 100 will be described below with reference to FIG. 3.

Another function of the security-only chip 100 according to the present invention is to serve as a main processor of the home collection unit (HCU) 300 for reading electricity, water and gas in a PLC-based integrated metering network. The existing main processor has a low efficiency by only acting as a crosslinking role between the PLC chip 200 and the RF chip 302, but the security dedicated chip 100 performs this instead, thereby greatly reducing the cost. . Referring to FIG. 3, when the RF chip 302 of the HCU communicates with the water and gas meter RF module to receive RF data, the RF chip 302 is transferred to the security dedicated chip 100, and the security dedicated chip 100 is applied to the data. After performing the security function by passing the result value to the PLC chip 200, the corresponding data is transmitted to the meter reading server through the data transmission device. At this time, the electric meter reading value is directly transferred from the electricity meter through the IR interface 301, not the conventional PLC chip, so that the electricity meter is not the order of "meter meter → PLC chip → security chip → PLC chip". The electricity reading value is moved in order from the security-only chip to the PLC chip to reduce the overhead of data transmission.

1 is a block diagram showing the internal configuration of a security-only device according to the present invention.

Figure 2 is a block diagram showing a PLC chip or RF chip coupled to the security-only device according to the present invention.

Figure 3 is a block diagram showing the configuration for use in the home collection device is combined with a power meter to the security-only device according to the present invention.

-Explanation of the symbols for the main parts of the drawings-

100; Security only device

101; interface

102; CPU

103; Cancer and decryption department

104; Data Integrity Verifier

105; Communication device certification

106; Memory

107; Random number generator

200; PLC chip

204; Security Key Management Department

206; Integrity checker

302; RF chip

Claims (8)

As a security-only device for processing security functions of power communication (PLC) based communication devices, An interface for transmitting and receiving data with the communication device; And A main controller; The main controller includes an encryption / decryption unit, a data integrity verification unit, a communication device authentication unit, a security key manager, an electronic signature unit, and a certificate manager; The main controller receives data to be transmitted by the communication device through the interface to perform integrity verification by the data integrity verification unit, digital signature by the electronic signature unit, and data encryption by the encryption / decryption unit. Output to the communication device through the interface, The demodulated data received by the communication device is received through the interface, decrypted by the encryption / decryption unit, signature verification by the digital signature unit, and data integrity verification by the data integrity verification unit. And output to the communication device via an interface. The communication device security function processing of claim 1, wherein the security key manager is operable to generate, distribute, update, and discard a security key required for the encryption / decryption and the integrity verification, and uses a public key management mechanism. Security only device for use. The apparatus of claim 1, wherein the interface for data communication with the communication device transmits and receives data by serial communication. The apparatus of claim 1, further comprising a nonvolatile memory inside the security-only device so as to perform authentication of the communication device, and mounting a certificate therein according to a security policy of a company that owns and manages the communication device. A security-only device for processing a communication device security function, which secretly generates a certificate and mounts it inside the security-only device. 2. The method of claim 1, wherein said data comprises integrated meter reading data; And the communication device authentication unit is operable to transmit an electronic signature to the data by using its own certificate before transmitting the integrated reading data, and transmit the data. 6. A device as claimed in any one of claims 1 to 5, wherein an RF chip is further coupled to the device for security. A dedicated security device of claim 1; An RF chip, a PLC chip, and a power meter coupled to the security-only device; An in-house collection unit (HCU) for remote reading of electricity, water, and gas; The security only device is connected to the RF chip and the PLC chip in the HCU to serve as a main controller of the HCU; The security-only device is a PLC-based integrated meter reading apparatus for processing the data output from the electricity meter to the PLC-based communication device. 8. The integrated PLC-based meter reading device of claim 7, wherein the security-only device is embedded in an RF communication device of a water and gas meter.

Images